Better NtDeviceIoControlFile logging for ntsockets

[KillerInstinct]

The code is kinda ugly with goto, but it's about as clean as I can get it to re-use existing log formatter in cases where exceptions may occur / sanity checks fail.

Untested :)

[gemini-code-assist]

Summary of Changes

Hello @KillerInstinct, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing the visibility and detail of network-related operations within ntsockets by significantly upgrading the NtDeviceIoControlFile hook. It introduces intelligent handling for various AFD IOCTLs, including pre-call buffer preservation and post-call asynchronous event waiting, to provide comprehensive and accurate logging of network traffic and associated metadata.

Highlights

• Enhanced NtDeviceIoControlFile Logging: I've significantly improved the logging for NtDeviceIoControlFile calls, specifically targeting network-related IOCTLs such as AFD_BIND, AFD_CONNECT, AFD_SEND, and AFD_RECV. The new logging provides more detailed and context-specific information for these operations.
• Input Buffer Preservation: To ensure accurate logging, especially for IOCTL_AFD_SEND, I've implemented logic to save a copy of the InputBuffer before the original NtDeviceIoControlFile call. This is crucial because the buffer might be modified or clobbered during the API execution.
• Asynchronous I/O Logging for Recv: For IOCTL_AFD_RECV operations that return STATUS_PENDING, I've added a mechanism to wait for the associated event to be signaled. This allows the hook to capture and log the actual received data after the asynchronous operation completes, preventing deadlocks and providing complete payload information.
• Custom Network Utility Functions: I've introduced custom implementations for inet_ntop (named our_inet_ntop) and ntohs (named our_ntohs) to handle IP address and port conversions robustly within the logging context, ensuring proper data interpretation.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enhances logging for NtDeviceIoControlFile with detailed parsing for AFD socket operations and uses __try/__except for handling potentially invalid user-mode pointers. The review identified critical issues related to unchecked memory allocation results, which could lead to null pointer dereferences and crashes, and minor correctness and style issues.